Yamato Transport (Kuroneko) Data Breach
Japanese parcel delivery leader Yamato Transport Co., Ltd. publicly detailed on October 16, 2026, a major data breach affecting its Kuroneko Deferred Payment Service (Kuroneko Daikin Goharai Service).
Exposed Data Types
5- Names
- Physical addresses
- Phone numbers
- Email addresses
- Purchase histories
About This Breach
Unauthorized access was detected and cut off on September 28, 2026, after attackers exfiltrated approximately 5,310,000 transaction and customer records collected between October 1, 2018, and September 28, 2026.
The stolen files included roughly 5.26 million buyer records, 50,000 delivery recipient records, and 4,100 merchant records, exposing full names, physical addresses, telephone numbers, itemized order details (product names, quantities, and unit prices), and around 490,000 email addresses. Yamato confirmed that no credit card numbers or passwords were compromised.
Verification and editorial method
LeakData compares the incident name, date, affected-record count, and exposed data types with accessible sources. Unverified fields are not presented as facts, and records are updated when new evidence becomes available.
Report missing or incorrect information
